> Email clients alternative to Gmail, as well as any app that accesses what Google deems "sensitive user data" (including emails, calendar, fit data etc.) will now require an expensive (talking of at least $4500 a year) and intentionally cumbersome certification process, and such a certification needs to be renewed on a yearly basis

Isn't Google required under the GDPR to verify the security and privacy compliance of any third party apps they send user data to? This really starts to cast doubt on the rest of the story for me; any app developer who hasn't been hiding under a rock since 2010 must know why modern companies insist on certifying third party apps with API access.